EU frameworkGDPRNIS 2DORAAI ActWhistleblowing
Recital 4

Recital 4

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(4)

Whistleblower protection currently provided in the Union is fragmented across Member States and uneven across policy areas. The consequences of breaches of Union law with a cross-border dimension reported by whistleblowers illustrate how insufficient protection in one Member State negatively impacts the functioning of Union policies not only in that Member State, but also in other Member States and in the Union as a whole.

Luxembourg specificity
loi luxembourgeoise du 16 mai 2023 relative à la protection des lanceurs d'alerte

In Luxembourg, the law of 16 May 2023 on the protection of whistleblowers transposes the directive with a broader scope than the EU minimum: it covers all breaches of national and European law, not just the 10 areas of the directive. The Office des rapports de signalement (OFRS) is the cross-cutting external authority, supplemented by CSSF, CNPD, ITM, CAA and ILR depending on the field. The 50-employee threshold applies to private and public entities, with no threshold for public bodies. Criminal sanctions: fines from 1,250 to 25,000 EUR, doubled in case of recidivism, plus full civil compensation of the whistleblower.

Luxgap practice: for a Luxembourg group with foreign subsidiaries, declare the OFRS as the reference authority in your internal channel, but maintain an up-to-date matrix of equivalent foreign authorities to avoid disorienting a cross-border whistleblower.